---
title: "Authentication and Access"
description: "Learn how authentication works in Sarah and how to keep your account secure."
keywords: ["authentication", "login", "access", "password", "security"]
lastUpdated: "2026-07-14"
---

# Authentication and Access

Authentication verifies your identity before you can use Sarah. This guide explains how it works and how to keep your account secure.

## Log In

Sarah does not use traditional passwords. Sign in with an **email link**, or — if enabled — with **quick access** (fingerprint / Face ID / device PIN).

### Login with email (magic link)

1. Go to `https://sarah.ar` or `https://www.sarah.ar`
2. Enter your account **email**
3. Tap **Sign in or Register**
4. Open the **latest email** we sent (check spam if needed)
5. Open the link to sign in

**Tip:** If you request the link several times, always use the **latest** email. Older links may be invalid.

### Quick access (fingerprint / Face ID)

Skip waiting for email on devices you trust:

1. Sign in once with the email link
2. User menu (bottom left) → **Quick access (fingerprint / Face ID)**
3. Tap **Enable on this device** and confirm with fingerprint, Face ID, or PIN
4. Next time, on login use **Sign in with fingerprint or Face ID**

Quick access:

- Only works on devices where you enabled it
- Is the **same account** (same role and permissions)
- Email magic links remain available as a backup

## Session Security

### Session Duration

Sessions in Sarah:

- **Have expiration time**: After a period of inactivity, session closes
- **Require re-authentication**: For sensitive operations
- **Can be closed manually**: You can log out when you want

### Log Out

To log out:

1. **Click your profile** or user menu
2. **Select "Log Out"**
3. **Confirm** if requested

**Important:** Always log out when using shared computers.

### Multiple Devices

You can log in from multiple devices:

- **Computer**: For administrative work
- **Tablet**: For mobile POS
- **Phone**: For quick queries

**Note:** Each device maintains its own session.

## Two-Factor Authentication (2FA)

### What is 2FA?

Two-factor authentication adds an additional security layer:

1. **Something you know**: Your password
2. **Something you have**: A code from your phone or app

### Configure 2FA

If 2FA is available:

1. **Go to security settings**
2. **Enable 2FA**
3. **Scan QR code** with your authentication app
4. **Enter code** to confirm
5. **Save configuration**

**Recommended apps:**
- Google Authenticator
- Authy
- Microsoft Authenticator

### Use 2FA

When 2FA is enabled:

1. **Log in** with email and password
2. **2FA code requested**: Open your authentication app
3. **Enter code**: Enter 6-digit code
4. **Access granted**: If code is correct, you access

## Best Practices

### Secure Passwords

- ✅ **Use unique passwords**: Don't reuse passwords
- ✅ **Adequate length**: Minimum 12 characters
- ✅ **Complexity**: Mix of uppercase, lowercase, numbers, and symbols
- ✅ **Don't share**: Never share your password
- ✅ **Change regularly**: Change passwords every 3-6 months

### Session Management

- ✅ **Log out**: Always log out on shared computers
- ✅ **Don't save passwords**: Don't save passwords in shared browsers
- ✅ **Use incognito mode**: If necessary, use incognito mode on shared computers
- ✅ **Monitor sessions**: Regularly review active sessions

### Two-Factor Authentication

- ✅ **Enable 2FA**: If available, enable it
- ✅ **Protect your device**: Secure your phone or 2FA device
- ✅ **Backup codes**: Save backup codes in a safe place
- ✅ **Don't share codes**: Never share 2FA codes

## Common Problems

### Cannot Log In

**Possible causes:**
- Incorrect password
- Incorrect email
- Disabled account
- Temporary problem

**Solution:**
1. Verify email is correct
2. Try to recover password
3. Contact support if it persists

### Forgot Password

**Solution:**
1. Use "Forgot your password?" function
2. Check your email (also spam)
3. Follow email instructions
4. Create a new password

### Don't Receive Recovery Email

**Possible causes:**
- Incorrect email
- Email in spam
- Delay in sending

**Solution:**
1. Verify email is correct
2. Check spam folder
3. Wait a few minutes
4. Contact support if it persists

### Session Closes Constantly

**Possible causes:**
- Inactivity time
- Multiple sessions
- Cookie problem

**Solution:**
1. Ensure you're active
2. Close other sessions
3. Clear browser cookies
4. Contact support if it persists

## Additional Security

### Suspicious Activity Detection

Sarah can detect:

- **Logins from new locations**
- **Multiple failed attempts**
- **Unusual activities**

If something suspicious is detected:

- Additional verification may be required
- Email notification may be sent
- Access may be temporarily blocked

### Report Problems

If you suspect your account was compromised:

1. **Change your password** immediately
2. **Close all active sessions**
3. **Review recent activities**
4. **Contact support** immediately

## Next Steps

- [Roles and Permissions](/docs/security/permissions) - Learn about roles
- [Introduction to Security](/docs/security/overview) - Review security measures